@llblab/pi-actors 0.45.0 → 0.46.0

package/scripts/recipe-utils.mjs

@@ -1,405 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Recipe utility command bundle.
- * Zones: recipe utilities, deterministic helper subcommands
- */
-
-// @ts-nocheck
-
-import {
-  appendFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
-import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
-
-function usage() {
-  console.error(`Usage:
-  recipe-utils.mjs run-summary <state-root>
-  recipe-utils.mjs run-ops-snapshot <state-root> <run-id> [lines] [stale-minutes]
-  recipe-utils.mjs playlist <source-dir> [extensions] [max-depth] [paths|m3u|inline]
-  recipe-utils.mjs changelog-section <file> <version>
-  recipe-utils.mjs artifact-manifest <artifact-path> <title> <status> [summary]
-  recipe-utils.mjs artifact-write <artifact-path> [create|overwrite|append]
-  recipe-utils.mjs package-summary <package-json>
-  recipe-utils.mjs skill-summary <skill-md> [package-json]`);
-}
-
-function fail(message) {
-  console.error(message);
-  process.exit(1);
-}
-
-function walkFiles(dir, maxDepth = 2, depth = 0, out = []) {
-  if (depth > maxDepth || !existsSync(dir)) return out;
-  for (const entry of readdirSync(dir)) {
-    const path = join(dir, entry);
-    const stat = statSync(path);
-    if (stat.isDirectory()) walkFiles(path, maxDepth, depth + 1, out);
-    else if (stat.isFile()) out.push(path);
-  }
-  return out;
-}
-
-function readJson(file) {
-  if (!existsSync(file)) return undefined;
-  try {
-    return JSON.parse(readFileSync(file, "utf8"));
-  } catch {
-    return undefined;
-  }
-}
-
-function getRunStatus(run, progress, result) {
-  if (progress?.phase) return progress.phase;
-  if (result?.code !== undefined) return result.code === 0 ? "done" : "failed";
-  return run.status ?? "unknown";
-}
-
-function collectRunSummary(rootValue) {
-  const root = resolve(
-    rootValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  const files = walkFiles(root, 2).filter((file) => basename(file) === "run.json");
-  const rows = [];
-  for (const file of files) {
-    const run = readJson(file);
-    if (!run) {
-      rows.push({
-        run: relative(root, file),
-        status: "invalid-json",
-        recipe: "",
-        updated: "",
-      });
-      continue;
-    }
-    const runDir = dirname(file);
-    const progress = readJson(join(runDir, "progress.json"));
-    const result = readJson(join(runDir, "result.json"));
-    rows.push({
-      run: run.run_id ?? run.run ?? relative(root, file).split(sep)[0],
-      status: getRunStatus(run, progress, result),
-      recipe: run.recipe ?? run.recipe_file ?? "",
-      updated:
-        progress?.updatedAt ??
-        result?.completedAt ??
-        run.updated_at ??
-        run.completed_at ??
-        run.started_at ??
-        "",
-    });
-  }
-  rows.sort((a, b) =>
-    `${a.status}:${a.run}`.localeCompare(`${b.status}:${b.run}`),
-  );
-  return rows;
-}
-
-function runSummary(rootValue) {
-  console.log(JSON.stringify(collectRunSummary(rootValue), null, 2));
-}
-
-function tailJsonl(fileValue, linesValue = "80") {
-  const file = resolve(
-    fileValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  if (!existsSync(file)) return [];
-  const lines = Number.parseInt(linesValue, 10);
-  const count = Number.isFinite(lines) && lines > 0 ? lines : 80;
-  return readFileSync(file, "utf8")
-    .trimEnd()
-    .split("\n")
-    .filter(Boolean)
-    .slice(-count)
-    .map((line) => {
-      try {
-        return JSON.parse(line);
-      } catch {
-        return { raw: line };
-      }
-    });
-}
-
-function runOpsSnapshot(
-  rootValue,
-  runIdValue = "music",
-  linesValue = "80",
-  staleMinutesValue = "60",
-) {
-  const runs = collectRunSummary(rootValue);
-  const root = resolve(
-    rootValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  const inspectedRun = String(runIdValue || "music");
-  const traceFile = join(root, inspectedRun, "trace.jsonl");
-  const staleMs = Number(staleMinutesValue) * 60 * 1000;
-  const now = Date.now();
-  const recommendations = runs.flatMap((run) => {
-    const updatedMs = Date.parse(run.updated || "");
-    const stale =
-      Number.isFinite(updatedMs) &&
-      Number.isFinite(staleMs) &&
-      now - updatedMs > staleMs;
-    if (run.status === "running" && stale) {
-      return [
-        {
-          run: run.run,
-          reason: "running-stale",
-          suggested_inspect: {
-            target: `run:${run.run}`,
-            view: "control",
-          },
-        },
-      ];
-    }
-    if (["failed", "exited", "killed"].includes(run.status)) {
-      return [
-        {
-          run: run.run,
-          reason: `terminal-${run.status}`,
-          suggested_inspect: { target: `run:${run.run}`, view: "trace" },
-        },
-      ];
-    }
-    return [];
-  });
-  console.log(
-    JSON.stringify(
-      {
-        runs,
-        inspectedRun,
-        trace: tailJsonl(traceFile, linesValue),
-        recommendations,
-      },
-      null,
-      2,
-    ),
-  );
-}
-
-function playlist(
-  sourceValue,
-  extensionsValue = ".mp3,.ogg,.wav,.flac,.m4a",
-  maxDepthValue = "2",
-  outputMode = "paths",
-) {
-  const source = resolve(
-    sourceValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  const maxDepth = Number.parseInt(maxDepthValue, 10);
-  const extensions = new Set(
-    extensionsValue
-      .split(",")
-      .map((item) => item.trim().toLowerCase())
-      .filter(Boolean),
-  );
-  const files = walkFiles(source, Number.isFinite(maxDepth) ? maxDepth : 2)
-    .filter((file) => extensions.has(extname(file).toLowerCase()))
-    .sort((a, b) => a.localeCompare(b));
-  if (outputMode === "m3u") console.log(["#EXTM3U", ...files].join("\n"));
-  else if (outputMode === "inline") console.log(files.join("|"));
-  else console.log(files.join("\n"));
-}
-
-function artifactManifest(
-  pathValue,
-  title = "Artifact",
-  status = "draft",
-  summary = "",
-) {
-  const path = resolve(
-    pathValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  const exists = existsSync(path);
-  const stat = exists ? statSync(path) : undefined;
-  console.log(
-    JSON.stringify(
-      {
-        title,
-        status,
-        path,
-        exists,
-        bytes: stat?.size ?? 0,
-        modified: stat?.mtime?.toISOString?.() ?? null,
-        summary,
-      },
-      null,
-      2,
-    ),
-  );
-}
-
-function artifactWrite(pathValue, mode = "create") {
-  const path = resolve(
-    pathValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  if (!["create", "overwrite", "append"].includes(mode)) {
-    fail(`Invalid artifact write mode: ${mode}`);
-  }
-  if (mode === "create" && existsSync(path)) {
-    fail(`Artifact already exists: ${path}`);
-  }
-  const content = readFileSync(0, "utf8");
-  mkdirSync(dirname(path), { recursive: true });
-  if (mode === "append") appendFileSync(path, content);
-  else writeFileSync(path, content, "utf8");
-  const stat = statSync(path);
-  console.log(
-    JSON.stringify({ path, mode, bytes: stat.size, written: true }, null, 2),
-  );
-}
-
-function packageSummary(fileValue = "package.json") {
-  const file = resolve(
-    fileValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  const pkg = readJson(file);
-  if (!pkg) fail(`Package JSON not found or invalid: ${fileValue}`);
-  const scripts =
-    pkg.scripts && typeof pkg.scripts === "object"
-      ? Object.keys(pkg.scripts).sort()
-      : [];
-  const dependencies =
-    pkg.dependencies && typeof pkg.dependencies === "object"
-      ? Object.keys(pkg.dependencies).sort()
-      : [];
-  const devDependencies =
-    pkg.devDependencies && typeof pkg.devDependencies === "object"
-      ? Object.keys(pkg.devDependencies).sort()
-      : [];
-  console.log(
-    JSON.stringify(
-      {
-        name: pkg.name ?? "",
-        version: pkg.version ?? "",
-        type: pkg.type ?? "",
-        private: Boolean(pkg.private),
-        packageManager: pkg.packageManager ?? "",
-        files: Array.isArray(pkg.files) ? pkg.files : [],
-        bin: pkg.bin ?? null,
-        main: pkg.main ?? "",
-        exports: pkg.exports ?? null,
-        scripts,
-        dependencyCount: dependencies.length,
-        devDependencyCount: devDependencies.length,
-        dependencies,
-        devDependencies,
-      },
-      null,
-      2,
-    ),
-  );
-}
-
-function parseSkillFrontmatter(content) {
-  const frontmatter = content.match(/^---\n([\s\S]*?)\n---/)?.[1] ?? "";
-  const fields = {};
-  for (const line of frontmatter.split(/\r?\n/)) {
-    const match = line.match(/^([A-Za-z_][\w-]*):\s*(.*)$/);
-    if (match) fields[match[1]] = match[2].trim();
-  }
-  return { frontmatter, fields };
-}
-
-function skillSummary(skillValue, packageValue = "package.json") {
-  const skillFile = resolve(
-    skillValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  const packageFile = resolve(
-    packageValue.replace(/^~(?=\/|$)/, process.env.HOME ?? "~"),
-  );
-  const content = readFileSync(skillFile, "utf8");
-  const pkg = readJson(packageFile) ?? {};
-  const { frontmatter, fields } = parseSkillFrontmatter(content);
-  const scalarLines = frontmatter
-    .split(/\r?\n/)
-    .filter((line) => /^\w+:\s*\S/.test(line));
-  const extraColonLines = scalarLines.filter(
-    (line) => (line.match(/:/g) ?? []).length > 1,
-  );
-  const body = content.replace(/^---\n[\s\S]*?\n---\n?/, "");
-  const version =
-    fields.version ??
-    frontmatter.match(/^\s+version:\s*([^\n]+)\s*$/m)?.[1]?.trim() ??
-    "";
-  console.log(
-    JSON.stringify(
-      {
-        path: skillValue,
-        name: fields.name ?? "",
-        description: fields.description ?? "",
-        version,
-        packageVersion: pkg.version ?? "",
-        versionMatchesPackage: version === pkg.version,
-        frontmatterExtraColonLines: extraColonLines,
-        bodyLineCount: body.split(/\r?\n/).length,
-        headings: body.split(/\r?\n/).filter((line) => /^#{1,6}\s/.test(line)),
-      },
-      null,
-      2,
-    ),
-  );
-}
-
-function changelogSection(fileValue, version) {
-  const file = resolve(fileValue);
-  const lines = readFileSync(file, "utf8").split(/\r?\n/);
-  const start = lines.findIndex(
-    (line) => line.startsWith("## ") && line.includes(version),
-  );
-  if (start < 0) fail(`Version section not found: ${version}`);
-  let end = lines.length;
-  for (let index = start + 1; index < lines.length; index += 1) {
-    if (lines[index].startsWith("## ")) {
-      end = index;
-      break;
-    }
-  }
-  console.log(lines.slice(start, end).join("\n").trimEnd());
-}
-
-function runRecipeUtils(argv = process.argv.slice(2)) {
-const [command, ...args] = argv;
-if (!command) {
-  usage();
-  process.exit(1);
-}
-
-if (command === "run-summary")
-  runSummary(args[0] ?? "~/.pi/agent/tmp/pi-actors/runs");
-else if (command === "run-ops-snapshot")
-  runOpsSnapshot(
-    args[0] ?? "~/.pi/agent/tmp/pi-actors/runs",
-    args[1] ?? "music",
-    args[2],
-    args[3],
-  );
-else if (command === "playlist")
-  playlist(args[0] ?? "~/Music", args[1], args[2], args[3]);
-else if (command === "changelog-section")
-  changelogSection(args[0] ?? "CHANGELOG.md", args[1] ?? "Unreleased");
-else if (command === "artifact-manifest")
-  artifactManifest(args[0] ?? "artifact.md", args[1], args[2], args[3]);
-else if (command === "artifact-write")
-  artifactWrite(args[0] ?? "artifact.md", args[1] ?? "create");
-else if (command === "package-summary")
-  packageSummary(args[0] ?? "package.json");
-else if (command === "skill-summary")
-  skillSummary(args[0] ?? "skills/actors/SKILL.md", args[1] ?? "package.json");
-else {
-  usage();
-  fail(`Unknown command: ${command}`);
-}
-}
-
-try {
-  runRecipeUtils(process.argv.slice(2));
-} catch (error) {
-  console.error(error instanceof Error ? error.message : String(error));
-  process.exit(1);
-}

package/scripts/release-gates.mjs

@@ -1,278 +0,0 @@
-#!/usr/bin/env node
-/** Reproducible exact-tree, Domain DAG, secret-hygiene, and ABCd release gates. */
-
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, extname, join, normalize, relative, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-
-const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const temp = mkdtempSync(join(tmpdir(), "pi-actors-release-index-"));
-const indexPath = join(temp, "index");
-const gitEnv = { ...process.env, GIT_INDEX_FILE: indexPath };
-const failures = [];
-
-function run(command, args, options = {}) {
-  const result = spawnSync(command, args, {
-    cwd: root,
-    encoding: "utf8",
-    maxBuffer: 32 * 1024 * 1024,
-    ...options,
-  });
-  if (result.status !== 0) {
-    throw new Error(
-      `${command} ${args.join(" ")} failed (${result.status}): ${(result.stderr || result.stdout || "no output").trim()}`,
-    );
-  }
-  return result.stdout;
-}
-
-function check(condition, message) {
-  if (!condition) failures.push(message);
-}
-
-function stagedText(path) {
-  const result = spawnSync("git", ["show", `:${path}`], {
-    cwd: root,
-    env: gitEnv,
-    encoding: "buffer",
-    maxBuffer: 16 * 1024 * 1024,
-  });
-  if (result.status !== 0) {
-    failures.push(`could not read staged file: ${path}`);
-    return undefined;
-  }
-  const bytes = result.stdout;
-  if (bytes.includes(0)) return undefined;
-  return bytes.toString("utf8");
-}
-
-function sourceImports(source) {
-  return [...source.matchAll(/^import(?:\s+type)?\s+(?:[^"']+?\s+from\s+)?["']([^"']+)["'];?$/gmu)]
-    .map((match) => match[1]);
-}
-
-function resolveLocalImport(from, specifier, sourceSet) {
-  if (!specifier.startsWith(".")) return undefined;
-  const base = normalize(join(dirname(from), specifier)).replaceAll("\\", "/");
-  const candidates = extname(base)
-    ? [base.replace(/\.js$/u, ".ts")]
-    : [`${base}.ts`, `${base}/index.ts`];
-  return candidates.find((candidate) => sourceSet.has(candidate));
-}
-
-try {
-  run("git", ["read-tree", "HEAD"], { env: gitEnv });
-  run("git", ["add", "-A"], { env: gitEnv });
-  run("git", ["diff", "--cached", "--check"], { env: gitEnv });
-  const files = run("git", ["ls-files", "-z"], { env: gitEnv })
-    .split("\0")
-    .filter(Boolean);
-  const fileSet = new Set(files);
-  console.log(`[release] exact temporary index: ${files.length} files`);
-
-  const secretPatterns = [
-    [/-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----[\s\S]{80,}?-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/u, "private-key block"],
-    [/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/u, "AWS access key"],
-    [/\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bgh[pousr]_[A-Za-z0-9]{20,}\b/u, "GitHub token"],
-    [/\bglpat-[A-Za-z0-9_-]{20,}\b|\bnpm_[A-Za-z0-9]{20,}\b|\bxox[baprs]-[A-Za-z0-9-]{10,}\b/u, "service token"],
-  ];
-  const publicPath = /^(?:README\.md|AGENTS\.md|BACKLOG\.md|CHANGELOG\.md|docs\/|skills\/|recipes\/)/u;
-  for (const path of files) {
-    const text = stagedText(path);
-    if (text === undefined) continue;
-    if (!path.startsWith("tests/") && !path.startsWith("fixtures/")) {
-      for (const [pattern, label] of secretPatterns) {
-        check(!pattern.test(text), `${label} detected in ${path}`);
-      }
-    }
-    if (publicPath.test(path)) {
-      check(!/(?:^|[\s"'`])\/home\/[A-Za-z0-9._-]+\//u.test(text), `machine-local path in ${path}`);
-    }
-  }
-  console.log("[release] bounded secret and public-path hygiene checked");
-
-  const removedPaths = [
-    "lib/messages.ts",
-    "lib/rooms.ts",
-    "lib/mailbox-loop.ts",
-    "lib/runs-mailbox.ts",
-    "lib/runs-messages.ts",
-    "lib/runs-outbox.ts",
-    "lib/tools-mailbox.ts",
-    "scripts/actor-worker.mjs",
-    "scripts/coordinator.mjs",
-    "recipes/actor-worker.json",
-    "recipes/pipeline-room-swarm.json",
-    "recipes/subagent-message.json",
-    "recipes/utility-actor-message.json",
-    "docs/actor-messages.md",
-    "docs/run-inspector.md",
-    "lib/run-inspector.ts",
-    "lib/run-inspector-overlay.ts",
-  ];
-  for (const path of removedPaths) check(!fileSet.has(path), `removed surface returned: ${path}`);
-
-  const currentSurface = /^(?:lib\/|scripts\/|recipes\/|fixtures\/|skills\/|docs\/|README\.md|AGENTS\.md)/u;
-  const forbiddenPatterns = [
-    [/room:</u, "room address"],
-    [/branch:</u, "branch address"],
-    [/communication\.json/u, "communication snapshot"],
-    [/\bActor(?:Address|Message)\b/u, "legacy actor type"],
-    [/\b(?:actor_address|default_room)\b/u, "legacy spawn placeholder"],
-    [/inbox\.jsonl/u, "legacy inbox state"],
-  ];
-  for (const path of files.filter((candidate) => currentSurface.test(candidate))) {
-    if (path === "BACKLOG.md" || path === "CHANGELOG.md" || path === "scripts/release-gates.mjs") continue;
-    const text = stagedText(path) ?? "";
-    for (const [pattern, label] of forbiddenPatterns) {
-      check(!pattern.test(text), `${label} in current surface: ${path}`);
-    }
-  }
-  const legacyFallbacks = new Map([
-    ["lib/observability.ts", "outbox.jsonl"],
-    ["lib/runs-status.ts", "events.jsonl"],
-    ["lib/runs-start.ts", "events.jsonl"],
-  ]);
-  for (const path of files.filter((candidate) => currentSurface.test(candidate))) {
-    if (path === "BACKLOG.md" || path === "CHANGELOG.md" || path === "scripts/release-gates.mjs") continue;
-    const text = stagedText(path) ?? "";
-    for (const term of ["outbox.jsonl", "events.jsonl"]) {
-      if (!text.includes(term)) continue;
-      check(legacyFallbacks.get(path) === term, `legacy state reference outside read-only fallback: ${path} (${term})`);
-    }
-  }
-  console.log("[release] removed-surface and legacy-fallback allowlists checked");
-
-  const directTraceWrite = /(?:appendFileSync|writeFileSync|writeText(?:Atomic)?)\s*\(\s*[A-Za-z0-9_.]*?(?:trace|event)(?:Path|File)/iu;
-  for (const path of files.filter((candidate) =>
-    (candidate.startsWith("lib/") && candidate.endsWith(".ts")) ||
-    (candidate.startsWith("scripts/") && candidate.endsWith(".mjs"))
-  )) {
-    if (path === "lib/runs-trace.ts") continue;
-    check(!directTraceWrite.test(stagedText(path) ?? ""), `direct Trace writer outside canonical authority: ${path}`);
-  }
-  const canonicalTrace = stagedText("lib/runs-trace.ts") ?? "";
-  check(/withFileMutationLock\(path/u.test(canonicalTrace), "canonical Trace append lacks mutation lock");
-  for (const path of [
-    "scripts/async-runner.mjs",
-    "scripts/locker.mjs",
-    "scripts/music-player.mjs",
-  ]) {
-    const text = stagedText(path) ?? "";
-    check(
-      text.includes('importRuntimeModule("runs-trace")') && text.includes("appendRunTraceEvent"),
-      `first-party Trace writer bypasses canonical runtime module: ${path}`,
-    );
-    if (path !== "scripts/async-runner.mjs") check(
-      text.includes('importRuntimeModule("runs-controls")') &&
-        !/function (?:read|write|claimControls|finalizeControls)\b/u.test(text),
-      `first-party Control writer bypasses canonical runtime module: ${path}`,
-    );
-  }
-  console.log("[release] canonical Trace and Control writer residue checked");
-
-  // owner | class | lock | record bound | byte bound | recovery
-  const appendOnlyOwners = new Set([
-    "lib/runs-trace.ts", // canonical Run evidence | token lock | 2048 | 4 MiB | compact valid suffix
-    "lib/runs-retention.ts", // shared kernel evidence | token lock | 256 | 1 MiB | skip malformed
-    "scripts/locker.mjs", // first-party actor state | token lock | 512 | 1 MiB | skip malformed
-    "lib/command-templates.ts", // complete execution capture | command owner | n/a | artifact policy | preserve
-    "scripts/async-runner.mjs", // captures/prompts | Run owner | n/a | artifact policy | preserve
-    "scripts/recipe-utils.mjs", // user-declared artifact | caller owner | n/a | caller policy | preserve
-    "scripts/release-gates.mjs", // build/test-only source inventory | n/a | n/a | n/a | self-match
-  ]);
-  const appendOnlyPattern = /\bappendFileSync\b|\b(?:writeFileSync|writeTextAtomic)\s*\([^)]*\{\s*flag:\s*["']a["']/su;
-  for (const path of files.filter((candidate) => /^(?:lib\/.*\.ts|scripts\/.*\.mjs)$/u.test(candidate)))
-    if (appendOnlyPattern.test(stagedText(path) ?? ""))
-      check(appendOnlyOwners.has(path), `unregistered shipped append-only writer: ${path}`);
-  for (const path of appendOnlyOwners) check(fileSet.has(path), `stale append-only owner inventory: ${path}`);
-  console.log(`[release] append-only owner inventory checked: ${appendOnlyOwners.size} source owners`);
-
-  check(
-    (stagedText("scripts/validate-recipe.mjs") ?? "").includes(
-      "qaReport.diagnostics.length === 0 && qaReport.warnings.length === 0",
-    ),
-    "Recipe QA warnings are not release-blocking",
-  );
-  console.log("[release] zero-warning Recipe QA gate checked");
-
-  const maximumShippedLines = 29_767;
-  const shippedPath = /^(?:lib\/|scripts\/|recipes\/|docs\/|skills\/)/u;
-  const shippedLines = files
-    .filter((path) => shippedPath.test(path))
-    .reduce((total, path) => total + (((stagedText(path) ?? "").match(/\n/gu) ?? []).length + 1), 0);
-  check(shippedLines <= maximumShippedLines, `shipped lines ${shippedLines} exceed release maximum ${maximumShippedLines}`);
-  console.log(`[release] shipped lines ${shippedLines} <= release maximum ${maximumShippedLines}`);
-
-  const sources = files.filter((path) => path === "index.ts" || (path.startsWith("lib/") && path.endsWith(".ts")));
-  const sourceSet = new Set(sources);
-  const graph = new Map();
-  for (const path of sources) {
-    const text = stagedText(path) ?? "";
-    const headerEnd = text.indexOf("*/");
-    const header = headerEnd >= 0 ? text.slice(0, headerEnd + 2) : "";
-    check(
-      header.startsWith("/**") && (header.includes("Zones:") || header.includes("Owns:")),
-      `missing domain header: ${path}`,
-    );
-    const edges = sourceImports(text)
-      .map((specifier) => resolveLocalImport(path, specifier, sourceSet))
-      .filter(Boolean);
-    graph.set(path, edges);
-    if (path.startsWith("lib/")) {
-      check(!edges.includes("index.ts"), `domain imports entrypoint: ${path}`);
-    }
-  }
-  const visiting = new Set();
-  const visited = new Set();
-  function visit(path, stack = []) {
-    if (visiting.has(path)) {
-      failures.push(`Domain DAG cycle: ${[...stack, path].join(" -> ")}`);
-      return;
-    }
-    if (visited.has(path)) return;
-    visiting.add(path);
-    for (const next of graph.get(path) ?? []) visit(next, [...stack, path]);
-    visiting.delete(path);
-    visited.add(path);
-  }
-  for (const path of sources) visit(path);
-  console.log(`[release] strict Domain DAG: ${sources.length} sources, acyclic`);
-
-  for (const path of ["README.md", "AGENTS.md", "BACKLOG.md", "CHANGELOG.md", "docs/README.md"]) {
-    check(fileSet.has(path), `missing ABCd root/context file: ${path}`);
-  }
-  const readStaged = (path) => stagedText(path) ?? "";
-  const readme = readStaged("README.md");
-  for (const path of ["AGENTS.md", "BACKLOG.md", "CHANGELOG.md", "docs/README.md"]) {
-    check(readme.includes(path), `README.md does not route to ${path}`);
-  }
-  for (const path of files.filter((candidate) => candidate.endsWith(".md"))) {
-    const text = readStaged(path);
-    for (const match of text.matchAll(/\[[^\]]*\]\(([^)]+)\)/gu)) {
-      const target = match[1].split("#", 1)[0];
-      if (!target || /^(?:https?:|mailto:)/u.test(target)) continue;
-      const resolved = normalize(join(dirname(path), decodeURIComponent(target))).replaceAll("\\", "/");
-      check(fileSet.has(resolved), `broken Markdown link: ${path} -> ${target}`);
-    }
-  }
-  const docsIndex = readStaged("docs/README.md");
-  for (const path of files.filter((candidate) => candidate.startsWith("docs/") && candidate.endsWith(".md") && candidate !== "docs/README.md")) {
-    check(docsIndex.includes(relative("docs", path).replaceAll("\\", "/")), `docs/README.md omits ${path}`);
-  }
-  console.log("[release] ABCd context roots, routing, and Markdown links checked");
-
-  if (failures.length > 0) {
-    for (const failure of failures) console.error(`[FAIL] ${failure}`);
-    process.exitCode = 1;
-  } else {
-    console.log("[release] all supplemental release gates passed");
-  }
-} catch (error) {
-  console.error(`[FAIL] ${error instanceof Error ? error.message : String(error)}`);
-  process.exitCode = 1;
-} finally {
-  rmSync(temp, { recursive: true, force: true });
-}